fix cors for production